CVE-2026-34935: PraisonAI: OS Command Injection in MCPHandler.parse_mcp_command()
Summary
The --mcp CLI argument is passed directly to shlex.split() and forwarded through the call chain to anyio.openprocess() with no validation, allowlist check, or sanitization at any hop, allowing arbitrary OS command execution as the process user.
Details
cli/features/mcp.py:61 (source) -> praisonaiagents/mcp/mcp.py:345 (hop) -> mcp/client/stdio/init.py:253 (sink) python source parts = shlex.split(command)
hop cmd, args, env = self.parsemcpcommand(command, envvars) self.serverparams = StdioServerParameters(command=cmd, args=arguments)
sink process = await anyio.openprocess([command, args])
Fixed in commit 47bff65413beaa3c21bf633c1fae4e684348368c (v4.5.69) by introducing a command allowlist: python ALLOWEDCOMMANDS = {"npx", "uvx", "node", "python"} if cmd not in ALLOWEDCOMMANDS: raise ValueError(f"Disallowed command: {cmd}")
PoC python tested on: praisonai==4.5.48 install: pip install praisonai==4.5.48 run: praisonai --mcp "bash -c 'id > /tmp/pwned'" verify: cat /tmp/pwned expected output: uid=1000(...) gid=1000(...) groups=1000(...)
Impact
Any deployment where the --mcp argument is influenced by untrusted input is exposed to full OS command execution as the process user. No authentication is required.
Other sources
PraisonAI is a multi-agent teams system. From version 4.5.15 to before version 4.5.69, the --mcp CLI argument is passed directly to shlex.split() and forwarded through the call chain to anyio.openprocess() with no validation, allowlist check, or sanitization at any hop, allowing arbitrary OS command execution as the process user. This issue has been patched in version 4.5.69.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/praisonaito a version that resolves this vulnerability.Fixed in 4.5.69 - Upgrade
Upgrade
praisonaito a version that resolves this vulnerability.Fixed in 4.5.69Patch 47bff65413beaa3c21bf633c1fae4e684348368c - Configuration
Ensure the MCP command allowlist is enforced so that the --mcp CLI argument only allows commands present in ALLOWED_COMMANDS (npx, uvx, node, python); any other cmd should be rejected (e.g., raise ValueError: Disallowed command).
PraisonAI CLI MCPHandler.parse_mcp_command() / mcp client stdio ALLOWED_COMMANDS = {"npx", "uvx", "node", "python"}